Skip to content

Latest commit

 

History

History
224 lines (168 loc) · 5.3 KB

1. Security Best Practices.md

File metadata and controls

224 lines (168 loc) · 5.3 KB

Security Best Practices

Ensuring the security of a Linux system is a critical task for any system administrator. This guide outlines key security best practices that can help protect your system from unauthorized access, vulnerabilities, and other security threats.

1. Introduction to Linux Security

  • Security Philosophy: The principle of least privilege, where users and processes are granted the minimum level of access necessary.
  • Security Layers: Combining multiple security mechanisms to provide defense-in-depth.

2. User and Group Management

2.1 Use the Principle of Least Privilege

  • Regular Users: Limit the use of the root account for administrative tasks. Use sudo for commands that require elevated privileges.
  • Command: 
    sudo adduser newuser
sudo usermod -aG sudo newuser
    • Creates a new user and adds them to the sudo group.

2.2 Strong Password Policies

  • Enforce Strong Passwords: Use tools like passwd to enforce strong password policies.

  • Command:

    sudo passwd newuser
    • Sets or changes the password for a user.

  • Password Aging: Enforce password expiration policies.

  • Command:

    sudo chage -M 90 newuser
    • Requires the user to change their password every 90 days.

3. Securing SSH

3.1 Disable Root Login via SSH

  • Command: 
    sudo nano /etc/ssh/sshd_config
    • Set PermitRootLogin to no.

3.2 Use SSH Key Authentication

  • Generate SSH Keys:

    ssh-keygen -t rsa -b 4096
    • Generates a pair of SSH keys for secure login.

  • Copy Public Key to Server:

    ssh-copy-id username@server_ip
    • Copies the public key to the server for authentication.

3.3 Change the Default SSH Port

  • Command: 
    sudo nano /etc/ssh/sshd_config
    • Change the Port directive to a non-standard port (e.g., Port 2222).

3.4 Use Fail2ban to Protect SSH

  • Install Fail2ban: 
    sudo apt-get install fail2ban
    • Protects SSH by banning IP addresses with too many failed login attempts.

4. Firewall Configuration

4.1 Use ufw (Uncomplicated Firewall)

  • Enable UFW:

    sudo ufw enable
    • Enables the UFW firewall.

  • Allow SSH:

    sudo ufw allow ssh
    • Allows SSH traffic through the firewall.

4.2 Basic Firewall Rules

  • Allow Specific Ports:

    sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
    • Allows HTTP and HTTPS traffic.

  • Deny All Incoming Traffic by Default:

    sudo ufw default deny incoming
    • Denies all incoming traffic unless explicitly allowed.

5. Keeping the System Updated

5.1 Regularly Update Software

  • Update Package Lists:

    sudo apt-get update
    • Updates the package list for upgrades.

  • Upgrade Installed Packages:

    sudo apt-get upgrade
    • Installs the latest versions of all installed packages.

  • Enable Automatic Security Updates:

    sudo apt-get install unattended-upgrades
    • Automatically installs security updates.

6. Monitoring and Auditing

6.1 Log Monitoring

  • Use logwatch: 
    sudo apt-get install logwatch
    • Monitors and summarizes log files for suspicious activity.

6.2 Auditing with auditd

  • Install auditd:

    sudo apt-get install auditd
    • Tracks system calls and file accesses for auditing purposes.

  • Start the Audit Service:

    sudo systemctl start auditd

6.3 File Integrity Monitoring with AIDE

  • Install AIDE:

    sudo apt-get install aide
    • Monitors file integrity and alerts on unauthorized changes.

  • Initialize the AIDE Database:

    sudo aideinit

7. Securing Network Services

7.1 Disable Unnecessary Services

  • List All Services:

    systemctl list-units --type=service
    • Lists all active services.

  • Disable a Service:

    sudo systemctl disable servicename
sudo systemctl stop servicename
    • Disables and stops an unnecessary service.

7.2 Configure Network Time Protocol (NTP)

  • Install and Enable NTP: 
    sudo apt-get install ntp
sudo systemctl enable ntp
sudo systemctl start ntp
    • Ensures accurate timekeeping, which is crucial for logging and security.

8. Disk Encryption

8.1 Encrypting Partitions with LUKS

  • Install Cryptsetup:

    sudo apt-get install cryptsetup
    • Tool for managing LUKS encryption.

  • Encrypt a Partition:

    sudo cryptsetup luksFormat /dev/sdX
    • Encrypts the specified partition.

  • Open and Use the Encrypted Partition:

    sudo cryptsetup luksOpen /dev/sdX crypted_partition
sudo mount /dev/mapper/crypted_partition /mnt

Conclusion

Implementing security best practices is essential for maintaining the integrity and safety of your Linux systems. By following these guidelines, you can significantly reduce the risk of unauthorized access and ensure your system remains secure. Regular updates, user management, and network security are key components of a robust security strategy.

Next: System Maintenance

Previous: Networking Configuration